The impact of formal and informal organizational norms on susceptibility to phishing : combining survey and field experiment data

Petrič, Gregor (avtor), Roer, Kai (avtor)

Phishing is one of the most common forms of social engineering that exploits human vulnerabilities and causes immense personal and organizational costs. This study advances the research on the factors of susceptibility to phishing in three regards. First, it addressed the role of organizational norms in susceptibility to phishing. Second, it aimed for high external and ecological validity by combining survey and phishing experiments data on large samples of organizations and their employees. Third, it employed a two-level design that considered explanatory variables at the individual and organizational levels. The study chiefly explored how formal, descriptive, injunctive, and personal norms influence employee interactions with phishing emails. To this end, an explanatory model was tested on 83,269 employees in 510 organizations using a multilevel modeling approach. Clicking on links in simulated phishing emails and entering personal information in simulated fraudulent websites were deemed as two types of susceptibility to phishing. Formal norms and collectively shared injunctive norms were found to exert the strongest effects on susceptibility to phishing; in contrast, personal norms exert a weak influence, and descriptive norms can result in a boomerang effect. These results have significant theoretical and practical implications for both researchers and managers seeking organizational-level mechanisms to reduce the threat of phishing emails.

• Jezik: Angleški jezik
• Ključne besede: information security, norms, human factors, social engineering, phishing, organizational behavior
• Vrsta gradiva: Članek v reviji
• Tipologija: 1.01 - Izvirni znanstveni članek
• Organizacija: FDV - Fakulteta za družbene vede
• Status publikacije: Objavljeno
• Različica publikacije: Objavljena publikacija
• Leto izida: 2022
• Št. strani: 15 str.
• Številčenje: Vol. 67, art. 101766
• PID: 20.500.12556/RUL-136392
• UDK: 005.7:004.738.5:343.52
• ISSN pri članku: 1879-324X
• DOI: 10.1016/j.tele.2021.101766
• COBISS.SI-ID: 106109699
• Datum objave v RUL: 28.04.2022

Gradivo je del revije

• Naslov: Telematics and informatics
• Skrajšan naslov: Telemat. inform.
• Založnik: Elsevier
• ISSN: 1879-324X
• COBISS.SI-ID: 23250181

Licence

• Licenca: CC BY 4.0, Creative Commons Priznanje avtorstva 4.0 Mednarodna
• Povezava: http://creativecommons.org/licenses/by/4.0/deed.sl
• Opis: To je standardna licenca Creative Commons, ki daje uporabnikom največ možnosti za nadaljnjo uporabo dela, pri čemer morajo navesti avtorja.

Sekundarni jezik

• Jezik: Slovenski jezik
• Ključne besede: informacijsko-komunikacijska tehnologija, varnost, phishing prevare, organizacijsko vedenje